CVE-2020-6173: Medium severity linuxfoundation The Update Framework vulnerability
Impact An attacker who can gain file access to the repository and modify metadata files may cause a denial of service to clients by creating many invalid signatures on a metadata file. Having a large number of signatures to verify will delay the moment when the client will determine the signature is not valid. This delay may be for at least a few minutes, but possibly could be longer especially if multiple files are impacted.
The tuf maintainers would like to thank Erik MacLean of Analog Devices, Inc. for reporting this issue.
Patches No fix exists for this issue.
Workarounds No workarounds are known for this issue.
References CVE-2020-6173 Issue #973
Other sources
TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/tufto a version that resolves this vulnerability.Fixed in 0.12.2
Event History
Frequently Asked Questions
What is CVE-2020-6173?
CVE-2020-6173 is a vulnerability in TUF (The Update Framework) versions 0.7.2 through 0.12.1 that allows uncontrolled resource consumption.
How severe is CVE-2020-6173?
CVE-2020-6173 has a severity rating of medium, with a CVSS score of 5.3.
What software versions are affected by CVE-2020-6173?
The versions of TUF affected by CVE-2020-6173 range from 0.7.2 to 0.12.1.
How can I fix CVE-2020-6173?
To fix CVE-2020-6173, upgrade TUF to a version higher than 0.12.1.
Where can I find more information about CVE-2020-6173?
You can find more information about CVE-2020-6173 on the official GitHub repository of TUF, including the commits and issues related to the vulnerability.